HRM-System/docs/PLAN-branch-manager-map.md

PLAN: Branch Manager Scope & Map UI

1. Context & Objectives

• Objective 1: Improve the Map UI in LocationPicker.tsx by hiding the manual latitude and longitude inputs, leaving only the map and potentially the radius input. Make the radius visually draggable on the map.
• Objective 2: Implement branch-level isolation for managers. Managers with a specific role/permission (e.g., manage-branch-employees) should only be able to view, edit, and manage employees that belong to their own branch.

2. Technical Approach

Phase 1: Map UI Enhancements (Location Picker)

• Hide Lat/Lng Inputs: Modify resources/js/components/LocationPicker.tsx to hide the Latitude and Longitude input fields to clean up the UI.
• Draggable Radius:
  • Since standard Leaflet circles aren't draggable by default, we will implement a secondary "handle" marker on the edge of the circle.
  • When the user drags this handle, it will dynamically calculate the new distance to the center (using Haversine or Leaflet's distanceTo) and update the radius state in real-time.

Phase 2: Branch Manager Scope Restriction

• Database/Permissions: Add a new permission manage-branch-employees via a Laravel migration (using Spatie Permissions) to allow strict scoping.
• Employee Query Scoping:
  • Update EmployeeController@index (and other relevant list methods).
  • Add logic: elseif (Auth::user()->can('manage-branch-employees')) { $q->whereHas('employee', function($eq) use ($authUser) { $eq->where('branch_id', $authUser->employee->branch_id); }); }
• Validation/Protection:
  • Update show, edit, update, and destroy methods in EmployeeController to strictly verify that if the user only has manage-branch-employees, they cannot access an employee whose branch_id does not match their own.
• Attendance Records Scoping: Apply the same branch-level isolation to AttendanceRecordController so branch managers only see attendance logs for their own branch.

3. Execution Steps

1. Edit LocationPicker.tsx to hide lat/lng inputs.
2. Add draggable edge marker logic to LocationPicker.tsx for visual radius adjustment.
3. Create a Laravel migration to insert the manage-branch-employees permission.
4. Update EmployeeController.php queries and authorization checks to restrict by branch.
5. Update AttendanceRecordController.php queries to scope by branch.

4. Open Questions (Socratic Gate)

• For the manage-branch-employees permission, do you want me to create a dedicated Database Seeder/Migration for this new permission, or just adjust the logic so that anyone with manage-employees but without manage-any-employees is automatically restricted to their branch?
• Do you want this branch restriction to apply strictly to Employees and Attendance, or should it also extend to Leaves, Payroll, and other HR features?